Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 1 of 15

UNITED STATES DISTRICT COURT

DISTRICT OF RHODE ISLAND

WENDY MARFEO, individually and on

behalf of all others similarly situated,
§
§
CA10 - 262
§ CASE NO.
Plaintiff, §
§
v. § CLASS ACTION COMPLAINT
§
§
FACEBOOK, INC. §
§
Defendant. § JURY TRIAL DEMANDED

CLASS ACTION COMPLAINT

Plaintiff, Wendy Marfeo (hereafter "Marfeo" or "Plaintiff'), brings this action

individually and on behalf of a nationwide class of all other persons similarly situated in the

United States (hereafter "Class") against Facebook, Inc. (hereafter "Facebook" or "Defendant")

for violations of the Stored Communications Act (hereafter "SCA"), 18 U.S.C. § 2701 et seq,

breach of contract, breach of implied covenant of good faith and fair dealing, and unjust

enrichment. Plaintiff seeks damages and equitable relief on her own behalf and on behalf of the

Class to remedy violations of their privacy rights by Facebook's intentional and knowing

transmission of users' personal information to third-party advertisers without the users'

knowledge or consent in violation of Facebook's own Agreement with its users.

Plaintiff alleges the following upon personal knowledge as to her own acts, and upon

information and belief based on the investigation conducted by Plaintiff s Counsel, as to all other

matters:
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 2 of 15

FACTUAL ALLEGATIONS

1. Facebook is the largest social networking website service in the United

States with a website address found at http://www.facebook.com.

2. Facebook is a social networking website that allows users to share personally

identifiable information, other information, and communications with other users and/or the

public. Third-party advertisers also place advertisements on Facebook which users can click on.

3. Users must first join Facebook by registering and agreeing to Facebook's Terms

and Privacy Policies, before they are able to post and share personal information on Facebook's

website. Once registered, users may post personal information, including but not limited to,

name, address, phone number, email, gender, relationships, photographs, videos, and interests.

4. Facebook promises in its "Statement of Rights and Responsibilities" (hereafter

"Terms") and in its Privacy Policies (collectively hereafter "Contract" or "Agreement") not to share

users' information with or send personally identifiable information to third-party advertisers.

However, despite these promises, Facebook shares such information.

5. Section 10 of Facebook's Terms referred to as "About Advertisements on Facebook"

states that "We do not give your content or informationto advertisers without your consent."!

6. Section 5 of Facebook's Privacy Policy referred to as, "How We Use Your

Information," states, "We don't share your information with advertisers without your consent"

7. The advertisers section of Facebook's "Privacy Controls," states, "We never share

your personal information with our advertisers. Facebook's ad targeting is done entirely

anonymously... Advertisers only receive anonymous data reports."

1 <http://www.facebook.com/terms.php> (last visited on June 16,2010)

2 <http://www.facebook.com/#!/policy.php;> (last visited on June 16,2010)

3 <http://www.facebook.com/privacy/explanation.php> (last visited on June 16,2010)

-2-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 3 of 15

8. Barry Schnitt, a director on Facebook's communication and public policy team,

wrote in The Facebook Blog, dated April 5, 2010, "We don't share your information with

advertisers unless you tell us to... Any assertion to the contrary is false. Period... we never

provide the advertiser any names or other information about the people who are shown, or even

who click on, the ads.,,4

9. Despite all of the above contractual provisions and representations that Facebook

does not share information with third-party advertisers, Facebook, in violation of its own

Agreement and Privacy Policies, shared its users' personal information with third-party

advertisers. This violation was first articulated by Worcester Polytechnic Institute Computer

Science Professor Craig E. Wills and AT&T Computer Scientist and Researcher Balachander

Krishramurthy in an article published in August of 2009, entitled, "On the Leakage of Personally

Identifiable Information Via Online Social Networks."s

10. Wills' and Krishramurthy's article illustrates how online social networks, like

Facebook, release personally identifiable information that alone or in combination with other

publicly available information linkable to a specific individual can allow third-party advertisers

to use the leaked personally identifiable information from the Facebook network alone or in

combination with: (l) publicly available internet information that is linkable to a specific

individual from outside of the Facebook network; and/or (2) information from tracking cookies

to distinguish or trace a Facebook users' actual name and identity.

11. Facebook embeds and sends a user's Facebook ID in the URL Referrer Header

(which is like a website address that a user would use to navigate websites) when the user clicks

on a third-party advertisement posted on Facebook's website.

4 <http://blog.facebook.com/blog.php?post=379388037130> (last visited on June 16,2010)

5 <http://www2.research.att.com/~bala/papers/wosn09.pdf> (last visited on June 16,2010)

-3-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 4 of 15

12. When the third-party advertiser receives the Facebook's user ID, embedded in the

Referrer Header, that advertiser can then go back to the specific user's profile and obtain

personally identifiable information, such as the user's real name, address, photos, and much

more that the user has made publicly available either by choice or inadvertently by not changing

Facebook's default privacy settings that makes much of the user's information publicly

available.

13. As a result when Facebook users click on an advertisement, the advertiser can

determine the identity of the users and much more personal information from the users' profiles,

all in violation ofFacebook's Terms and Privacy Policies.

14. Facebook has been on notice of its sharing of personal information with third-

party advertisers since Wills' and Krishramurthy's article was released in August of 2009.

Wendy Davis, of Media Post, reported in September 2009 in an article entitled, "Social

Networks May 'Leak' Personally Identifiable Information," that Facebook "is investigating

further to determine what changes, if any, it can make.,,6

15. On May 21, 2010 the Wall Street Journal published an article entitled, "Facebook,

MySpace Confront Privacy Loophole," by Emily Steel and Jessica E. Vascellaro, referring to the

Wills and Krishnamurthy article and drew additional attention to the August 2009 article.7 The

Wall Street Journal article confirms that the researchers had contacted Facebook about the

leakage of personally identifiable information.

16. Despite Facebook's awareness of its improper sharing of users' personal

information with third-party advertisers from at least August of 2009, Facebook continued to

6 <http://www.mediapost.com/publications/?fa=Articles.showArticle&art_aid= I I4344&passFuseAction=
PublicationsSearch.showSearchReslts&art_searched=&page_number=O> (last visited on June 16, 2010)
7 <http://online.wsj.com/article/SBI 00014240527487045131 04575256701215465596.html?KEYWORD

S=facebook> (last visited on June 16,2010)

-4-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 5 of 15

share such information with third-party advertisers.

JURISDICTION AND VENUE

17. This Court has subject matter jurisdiction pursuant to the Class Action Fairness

Act of 2005, 28 U.S.C. §§ 1332(a) and 1332(d), because the amount in controversy exceeds

$5,000,000.00 exclusive of interests and costs, and more than two-thirds of the members of the

putative class are citizens of states different from that of Defendant.

18. Venue for this action properly lies in this District pursuant to 28 U.S.C. § 1391 as

the named Plaintiff resides in this District and Defendant has engaged in the business in this

District.

PARTIES

19. Plaintiff, Wendy Marfeo, is an individual who resides in North Providence, Rhode

Island and is a user of Facebook's social networking website service and has clicked on at least

one third-party advertisement appearing on Facebook's website.

20. Defendant, Facebook, is a Delaware corporation headquartered at Palo Alto,

California and does business in the State of Rhode Island and throughout the United States.

CLASS ACTION ALLEGATIONS

21. Plaintiff brings this action on behalf of herself and a Class of all other persons

similarly situated pursuant to Fed. R. Civ. P. 23 as defined as follows:

All Facebook users, who reside in the United States, whose user ID
was embedded in the URL Referrer Header, and who clicked on a
third-party advertisement displayed on Facebook's social
networking website, anytime on or before May 21,2010.

22. Excluded from the Class are Defendant; any parent, subsidiary, or affiliate of

Defendant or any employees, officers, or directors of Defendant; legal representatives,

successors, or assigns of Defendant; and any justice, judge or magistrate judge of the United

-5-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 6 of 15

States who may hear the case, and all persons related to any such judicial officer, as defined in

28 U.S.C. § 455(b).

23. Numerosity. The Class is so numerous and dispersed nationwide that joinder of all

members is impracticable. Upon information and belief, the Class numbers in the hundreds of

thousands, if not millions. The exact number of Class members is unknown, but can be

determined from Defendant's computerized and other records. Plaintiff reasonably estimates and

believes that there are thousands of persons in the Class.

24. Commonality. There are numerous and substantial questions of law and fact that

are common to all members of the Class, which questions predominate over any question

affecting only individual Class members. The members of the Class were and continue to be

subjected to the same practices of the Defendant. The common questions and principal common

issues raised by Plaintiffs claims include: whether Defendant shared Plaintiff and the Class'

personal information with third-party advertisers; whether Plaintiff consented to Defendant's

sharing of Plaintiffs personal information with third-party advertisers; whether Defendant

violated its own Terms and Privacy Policies by sharing of Plaintiffs personal information with

third-party advertisers; whether Plaintiff and the Class have been damaged as a result of the

Defendant's alleged violations as alleged herein; and if so the appropriate relief for Defendant's

violations; whether Defendant has violated the SCA and if so the appropriate measure of

damages and remedies against Defendant for any violations of the SCA; whether Defendant

breached its contracts and if so the appropriate measure of damages and remedies against

Defendant for such breach; whether Defendant breached the covenant of good faith and fair

dealing and if so the appropriate measure of damages and remedies against Defendant for such

breach; whether Defendant has been unjustly enriched as a result of its unlawful conduct, and if

- 6-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 7 of 15

so whether Defendant should disgorge inequitably obtained money that it has been unjustly

enriched by; and, the nature and extent of any other remedies, and injunctive relief, to which

Plaintiff and the Class are entitled.

25. Typicality. Plaintiffs claims are typical of the claims of all of the other Class

members, because her claims are based on the same legal and remedial theories as the claims of

the Class and arise from the same course of conduct by Defendant.

26. Adequacy. Plaintiff will fairly and adequately protect the interest of all Class

members in the prosecution of this Action and in the administration of all matters relating to the

claims stated herein. Plaintiff is similarly situated with, and has suffered similar injuries as, the

members of the Class she seeks to represent. Plaintiff has retained counsel experienced in

handling class action lawsuits. Neither Plaintiff nor her counsel has any interest which might

cause them not to vigorously pursue this action.

27. Superiority. A class action is superior to other available methods for the fair and

efficient adjudication of the controversy, since individual joinder of the Class is impracticable.

Even if individual Class members were able to afford individual litigation, it would be unduly

burdensome to the Courts in which the individual litigation would proceed. Defendant has

subjected the entire Class to the same violations as referenced herein. Accordingly, class

certification is appropriate under Rule 23 because common issues of law and fact regarding

Defendant's uniform violations predominate over individual issues, and class certification is a

superior method of resolving these claims. No unusual difficulties are likely to be encountered

in the management of this action as a class action. Defendant has acted and continues to act in a

manner that is generally applicable to all members of the Class making final injunctive relief

appropriate.

-7-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 8 of 15

CAUSES OF ACTION

FIRST CAUSE OF ACTION

(Stored Communications Act, 18 U.S.C. § 2701 et seq.)

28. Plaintiff, on behalf of herself and the Class, hereby incorporates by reference the

allegations contained in all of the preceding paragraphs of this complaint.

29. Defendant Facebook provides an electronic communication service to the public

via its social networking website service. 18 U.S.C. § 2510(15)

30. A user's personally identifiable information, including its users' IDs, is an

electronic communication within the meaning of 18 U.S.C. § 2510(12).

31. Facebook holds its users' personally identifiable information, including its

users' IDs, in electronic storage, 18 U.S.C. § 2510(17).

32. Facebook provides remote computing service to the public because it provides

computer storage and processing services by means of an electronic communications system. 18

U.S.C. § 2711(2).

33. In relevant part, 18 U.S.C. § 2701(a)(1)-(2) of the SCA provides that an offense is

committed by anyone who: (1) intentionally accesses without authorization a facility through

which electronic communication service is provided; or (2) intentionally exceeds an

authorization to access that facility; and thereby obtains ... [an] electronic communication while it

is in electronic storage in such system.

34. Facebook intentionally exceeded its authorization to access and control

confidential and private information relating to Plaintiff and the Class' electronic

communications in violation of 18 U.S.C. § 2701 et seq of the SCA.

35. Facebook knowingly, willfully, unlawfully and intentionally without

-8-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 9 of 15

authorization accessed confidential and private information relating to Plaintiff and the

Class' electronic communications in violation of 18 U.S.C. § 2701 et seq of the SCA.

36. In relevant part, 18 U.S.C. § 2702(a)(I)-(2) of the SCA provides that a person

or entity shall not: (l) ... knowingly divulge to any person or entity the contents of a

communication while in electronic storage by that service; and (2) ... shall not knowingly

divulge to any person or entity the contents of any communication which is carried or

maintained on that service.

37. By embedding its users' IDs in the Referrer Header and sharing personally

identifiable information with third-party advertisers, Defendant knowingly divulges the

contents of communications while those communications are in electronic storage, in

violation of 18 U.S.C. § 2702(a)(l), and knowingly divulges the contents of communications

that are carried and maintained by Facebook in violation of 18 U.S.C. § 2702(a)(2).

38. Facebook carries and maintains its users' personally identifiable information,

including its users' IDs, solely for the purpose of providing storage and computer processing

services to its users. Facebook is not authorized to access this information for purposes other

than providing storage and computer processing. 18 U.S.C § 2702(a)(2).

39. Facebook engages in the foregoing acts without obtaining the lawful consent

of its users 18 U.S.C. § 2702(b)(3).

40. Section 2707 of the SCA provides for a civil cause of action and allows for

damages, declaratory and equitable relief.

41. Plaintiff and the Class are entitled to statutory damages of no less than

$1,000.00 (one thousand dollars) per violation. Because Facebook's violations were willful

and intentional, Plaintiff and the Class are entitled to recover punitive damages as provided

- 9-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 10 of 15

by 18 U.S.C. § 2702(c).

SECOND CAUSE OF ACTION

(Breach of Contract)

42. Plaintiff, on behalf of herself and the Class, hereby incorporates by reference the

allegations contained in all of the preceding paragraphs of this complaint.

43. Defendant Facebook requires Plaintiff and the Class to register only after agreeing

to Facebook's Terms and Privacy Policies. The agreed upon Terms and Privacy Policies

constitute a valid and enforceable contract between Facebook and its users. Plaintiff and the

Class submit personally identifiable information to Facebook and Facebook's contract promises

Facebook would not share this information with third-party advertisers without the Plaintiffs

and the Class' consent.

44. Facebook states in its Terms and Privacy Policies that it will use only non-

personally identifiable attributes it has collected and that its advertisement targeting is done

entirely anonymously. Despite these promises, Facebook did in fact knowingly share

users' personally identifiable attributes and non-anonymous user information with third-

party advertisers in violation of its own Agreement with its users.

45. Plaintiff and the Class never consented to the sharing of their personally

identifiable information to third-party advertisers.

46. Plaintiff and the Class have performed their obligations under the contract.

47. Facebook materially breached its contractual obligations through its conduct as

alleged herein, including its transmission of Plaintiffs and the Class' personal information to

third-party advertisers including the Plaintiffs and the Class' user IDs without consent.

48. Plaintiff and the Class have been damaged as a direct and proximate result of

- 10 -
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 11 of 15

Facebook's breach of their Agreement with Plaintiff and the Class. Plaintiff and the Class have

been damaged in an amount to be proven at trial.

(THIRD CAUSE OF ACTION)

(Breach of Implied Covenant of Good Faith and Fair Dealing)

49. Plaintiff, on behalf of herself and the Class, hereby incorporates by reference the

allegations contained in all of the preceding paragraphs of this complaint.

50. Once Plaintiff and the Class agreed to use Facebook's social networking website,

they agreed to Defendant Facebook's Contract, its Terms and Privacy Policies, and as a result are

in an enforceable contract.

51. A covenant of good faith and fair dealing, which imposes upon each party to a

contract a duty of good faith and fair dealing in its performance, is implied in every contract,

including the Agreement that embodies the relationship between Facebook and its users.

52. Good faith and fair dealing is an element imposed by common law or statute as an

element of every contract under the laws of every state. Under the covenant of good faith and

fair dealing, both parties to a contract impliedly promise not to violate the spirit of the bargain

and not to intentionally do anything to injure the other party's right to receive the benefits of the

contract.

53. Plaintiff and the Class reasonably rely upon Facebook to act in good faith both

with regard to the terms of the Agreement and in the methods and manner in which it carries out

those terms. Bad faith can violate the spirit of the Agreement and may be overt or may consist of

inaction. Facebook's inaction in failing to adequately notify Plaintiff and the Class of the release

of personal information to third-party advertisers evidences bad faith and ill motive.

- 11 -
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 12 of 15

54. The Agreement is a form contract, the terms of which Plaintiff and the Class are

deemed to have accepted once Plaintiff and the Class sign up with Facebook. The Agreement

purports to give contractual discretion to Facebook relating to Facebook's protection of users'

privacy. Facebook is subject to an obligation to exercise that discretion in good faith. The

covenant of good faith and fair dealing is breached when a party to a contract uses discretion

conferred by the contract to act dishonestly or to act outside of accepted commercial practices.

Facebook breached its implied covenant of good faith and fair dealing by exercising bad faith in

using its discretionary rights to deliberately, routinely, and systematically make users' personal

information available to third-party advertisers.

55. Plaintiff and the Class have performed all, or substantially all, of the obligations

imposed on them under the Agreement, whereas Facebook has acted in a manner as to evade the

spirit of the Agreement, in particular by deliberately, routinely, and systematically without

notifying Plaintiff and the Class of its disclosure of users' personal information to third-party

advertisers. Such actions represent a fundamental wrong that is clearly beyond the reasonable

expectations of the parties. Facebook's disclosure of such information to third-party advertisers

is not in accordance with the reasonable expectations of the parties and evidences a dishonest

purpose.

56. Facebook's ill motive is further evidenced by its lack of obtaining users' consent

in its data mining efforts while at the same time consciously and deliberately utilizing data

mining to automatically and without notice provide user information to third party advertisers.

Facebook profits from advertising revenues derived from its data mining efforts from Plaintiff

and the Class.

- 12-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 13 of 15

57. The obligation imposed by the implied covenant of good faith and fair dealing is

an obligation to refrain from opportunistic behavior. Facebook has breached the implied

covenant of good faith and fair dealing in the Agreement through its policies and practices as

alleged herein. Plaintiff and the Class have sustained damages and seek a determination that the

policies and procedures of Facebook are not consonant with Facebook's implied duties of good

faith and fair dealing.

(FOURTH CAUSE OF ACTION)

(Unjust Enrichment)

58. Plaintiff, on behalf of herself and the Class, hereby incorporates by reference the

allegations contained in all of the preceding paragraphs of this complaint.

59. By engaging in the conduct described in this Complaint, Defendant has

knowingly obtained benefits from Plaintiff and the Class under circumstances such that it would

be inequitable and unjust for Defendant to retain them.

60. Defendant has received a benefit from Plaintiff and the Class and Defendant has

received and retained money from advertisers as a result of sharing users' personal information

with those advertisers without Plaintiffs and the Class' knowledge or consent as alleged in this

Complaint.

61. Plaintiff and the Class did not expect that Defendant would use their personal

information without their consent to earn money from third-party advertisers.

62. Defendant did knowingly use Plaintiffs and the Class' personal information

without their knowledge or consent to earn money from third-party advertisers and has full

knowledge of the benefit it has received from Plaintiff and the Class. If Plaintiff and the Class

- 13 -
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 14 of 15

had known the Defendant was sharing their personal information with third-party advertisers,

they would not have consented and Defendant would not have made money from the advertisers.

63. Defendant will be unjustly enriched if Defendant is permitted to retain the money

paid to it by the advertisers.

64. Defendant Facebook should be required to provide restitution of all money

obtained from its unlawful conduct.

65. Plaintiff and the Class are entitled to an award of compensatory and punitive

damages in an amount to be determined at trial or to the imposition of a constructive trust upon

the wrongful profit obtained by, revenues obtained by, and benefits conferred upon them as a

result of their wrongful actions as alleged in this Complaint.

66. Plaintiff and the Class have no remedy at law to prevent Defendant from

continuing the inequitable conduct alleged in this Complaint and the continued unjust retention

of the money Defendant received from third party advertisers.

REQUEST FOR RELIEF

WHEREFORE, Plaintiff, Wendy Marfeo, on behalf of herself and the Class, request the

following relief:

1. An order certifying that this action is properly brought and may be maintained as

a class action under Rule 23 of the Federal Rules of Civil Procedure, that Plaintiff be appointed

as Class Representative, and that Plaintiffs counsel be appointed Class Counsel;

2. An award of damages;

3. Restitution of all monies unjustly obtained or to be obtained from Plaintiff and

members of the Class;

4. Declaratory and injunctive relief;

- 14-
 Case 1:10-cv-00262-S-LDA Document 1 Filed 06/17/10 Page 15 of 15

5. An award of reasonable attorneys' fees and costs;

6. Such other relief at law or equity as this court may deem just and proper.

DATED: June 17,2010.

Peter N. Wasylyk (RI Bar # 3351)

LAW OFFICES OF PETER N. WASYLYK
1307 Chalkstone Avenue
Providence, Rhode Island 02908
401-831-7730 (telephone)
401-861-6064 (facsimile)
E-Mail:pnwlaw@aol.com

Additional Counsel for Plaintiff:

Andrew S. Kierstead
LAW OFFICE OF ANDREW KIERSTEAD
1001 SW 5th Avenue, Suite 1100
Portland, Oregon 97204
508-224-6246 (telephone)
508-224-4356 (facsimile)

- 15 -